Repos: Empty Sources, Deb822 & Security Fixes

- Enhanced repository detection logic in `modules/repos/repo_detect.sh`. Implemented `has_active_deb_sources()` for content-aware scanning across `sources.list`, `*.list`, and `*.sources` files. Empty or comment-only files are now correctly identified as "none" to trigger bootstrapping.
- Enforced Debian 13 (Trixie) specific logic in `detect_repo_format()`. Deb822 format is only applied when `debian.sources` is active; Bookworm and Bullseye systems default strictly to classic sources.list regardless of file presence.
- Added state guard against mixed configuration formats (deb822 + classic active simultaneously) with a warning prompt before writing, preventing duplicate entries in `/etc/apt/sources.list`.
- Rewrote `_repos_enable_components()` in `modules/repos.sh` to remove early returns when components are already enabled. The script now verifies and ensures security and updates sections exist/were written correctly if missing or different.
- Created new `bootstrap_repositories()` function for systems with no active sources. Includes user dialogue for format selection (Trixie) or auto-classic (older versions), backup/restore safety, and cleanup of empty sources.list files post-bootstrap.
- Fixed false success reporting in `modules/firmware.sh` and `gaming.sh`. Added pre-checks to ensure APT sources exist before attempting `sed -i` modifications; if sources are missing, the script now triggers a full repository bootstrap instead of silently failing.
- Implemented post-write verification in firmware/gaming modules to confirm components were actually added before reporting success to the user.
- Generalized backports detection in `modules/utils.sh` (`is_backports_enabled()`) to scan all `*.list` and `*.sources` files rather than relying on fixed canonical filenames.
- Corrected test harness variable expansion order and trimmed whitespace from component parsing logic during development verification.

modules/firmware.sh

@@ -340,7 +340,17 @@ _ensure_nonfree_repo() {
         return 0
     fi
 
-    if _confirm "non-free Repository" "Component 'non-free' (and 'non-free-firmware') is required for WiFi/Bluetooth/GPU firmware.\n\nAdd them to your APT repositories?"; then
+    if ! _confirm "non-free Repository" "Component 'non-free' (and 'non-free-firmware') is required for WiFi/Bluetooth/GPU firmware.\n\nAdd them to your APT repositories?"; then
+        return 1
+    fi
+
+    # No active sources at all → bootstrap a complete configuration
+    if ! has_active_deb_sources; then
+        backup_current_repos
+        if ! bootstrap_repositories "main contrib non-free non-free-firmware"; then
+            return 1
+        fi
+    else
         if [ -f /etc/apt/sources.list ]; then
             sudo sed -i '/^deb / { /non-free/! s/\(main[^ ]*\)/\1 non-free non-free-firmware/ }' /etc/apt/sources.list
         fi
@@ -350,11 +360,21 @@ _ensure_nonfree_repo() {
                 sudo sed -i '/^Components:/ { /non-free/! s/$/ non-free non-free-firmware/ }' "$f"
             done
         fi
-        sudo apt update
-        echo -e "${GREEN}non-free repository enabled.${NC}"
-        return 0
     fi
-    return 1
+
+    # Verify the component was actually added before reporting success
+    local nonfree_ok=false
+    [ -f /etc/apt/sources.list ] && grep -Eq '^[^#]*\bnon-free\b' /etc/apt/sources.list 2>/dev/null && nonfree_ok=true
+    [ -d /etc/apt/sources.list.d ] && grep -qr 'Components:.*\bnon-free\b' /etc/apt/sources.list.d/*.sources 2>/dev/null && nonfree_ok=true
+    [ -d /etc/apt/sources.list.d ] && grep -qrE '^[^#]*\bnon-free\b' /etc/apt/sources.list.d/*.list 2>/dev/null && nonfree_ok=true
+    if ! $nonfree_ok; then
+        echo -e "${RED}Failed to enable non-free repository. Check your APT sources.${NC}"
+        return 1
+    fi
+
+    sudo apt update
+    echo -e "${GREEN}non-free repository enabled.${NC}"
+    return 0
 }
 
 # ── Main entry point ──